CVE-2021-23421

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

Code injection

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

CVE-2021-23421

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

CVE-2021-23421 Prototype Pollution

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

CVE-2021-23421

CVE-2021-23421 affects merge-change: all versions are vulnerable to Prototype Pollution via the utils.set function. The root cause is an unsafe recursive merge that can propagate pollution to Object.prototype when certain properties (e.g., proto ) are set or when the path-based API is abused. The...

CVE-2021-23421

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

CVE-2021-23421: Improperly Controlled Modification of Object Prototype Attributes

All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function...

PT-2021-15509

Name of the Vulnerable Software and Affected Versions merge-change versions all Description The issue concerns Prototype Pollution via the utils.set function. This affects all versions of the package merge-change. Recommendations For all versions, consider disabling the utils.set function as a...

merge-change 软件包安全漏洞

merge-change is an open source simple library for deep merging of objects and other types, also for patching and immutable new. The merge-change package has a security vulnerability that makes the package susceptible to prototype contamination via the utils.set function...

Prototype Pollution

Overview open-graph is an Open Graph implementation for Node.js. Affected versions of this package are vulnerable to Prototype Pollution. The function parse could be tricked into adding or modifying properties of Object.prototype using a proto or constructor payload. PoC by Snyk // server.js cons...

GSD-2021-1001406 dma-buf/sync_file: Don't leak fences on merge failure

dma-buf/syncfile: Don't leak fences on merge failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.241 by commit...

UVI-2021-1001381 dma-buf/sync_file: Don't leak fences on merge failure

dma-buf/syncfile: Don't leak fences on merge failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.199 by commit...

UVI-2021-1001318 dma-buf/sync_file: Don't leak fences on merge failure

dma-buf/syncfile: Don't leak fences on merge failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.135 by commit...

UVI-2021-1001256 dma-buf/sync_file: Don't leak fences on merge failure

dma-buf/syncfile: Don't leak fences on merge failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.53 by commit...

UVI-2021-1001152 dma-buf/sync_file: Don't leak fences on merge failure

dma-buf/syncfile: Don't leak fences on merge failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.5 by commit...

PT-2021-29871

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.241 Description A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-29846

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.199 Description A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-29721

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.53 Description A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-29617

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.13.5 Description A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2021-25876

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.241 Description A potential issue exists where fences may be leaked on merge failure. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...